The developer fully documents and integration-tests the application on its intended platforms, providing security guidance on how keys and certificates are to be used (which certificates to load, how account-data keys are loaded through the firmware, when to roll keys) and performing final integration testing on the device that finds and fixes residual vulnerabilities from the integration.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.